make sure we use a real network address in case there are extra non-zero octets in hosts allow/deny

source/lib/access.c

@@ -43,7 +43,7 @@ static BOOL masked_match(const char *tok, const char *slash, const char *s)
 		return (False);
 	}
 	
-	return ((addr & mask) == net);
+	return ((addr & mask) == (net & mask));
 }
 
 /* string_match - match string against token */